behind proxy: ssl_client: archive.apache.org: certificate verification failed: unable to get local issuer certificate

[cigano]

Executing:

> docker-compose up -d

I got:

ssl_client: archive.apache.org: certificate verification failed: unable to get local issuer certificate

Got to solve replacing line 18 at download-kafka.sh:

wget "${url}" -O "/tmp/${FILENAME}"

By:

wget "${url}" -O "/tmp/${FILENAME}" || wget "${url/https/http}" --no-check-certificate -O "/tmp/${FILENAME}"

And line 35 at Dockerfile:

 && wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk \

By:

 && wget --no-check-certificate https://github.com/sgerrand/alpine-pkg-glibc/releases/download/${GLIBC_VERSION}/glibc-${GLIBC_VERSION}.apk \

But I'm not sure if this is the best way to solve it. If it is, I can submit a PR.

[sscaling]

I'm not seeing any issues on travis or locally. Perhaps you have an outdate base image (i.e. expired root trust store) ?

Try doing a docker-compose build --pull which should force pull the base image if it's out of date. Also make sure you have the current version of the Git repository as the older base images may have out-of-date root trust store.

Alternatively, you should just be able to use a pre-built kafka image hosted on dockerhub -https://hub.docker.com/r/wurstmeister/kafka/

[cigano]

@sscaling I think it is good to give a little bit of context here.

The image is the latest one. The problem is that all the company network connections are made through a certificate that apparently is not widely trusted, so some software point correctly that there's a SSL error.

Fixing this certificate is out of my reach, so what we need to do is usually tweaks. This is my suggestion for this Docker image, specifically. If nobody thinks it is necessary to improve, feel free to close this issue.

[sscaling]

The image is the latest one. The problem is that all the company network connections are made through a certificate that apparently is not widely trusted, so some software point correctly that there's a SSL error.

Do you mean via a proxy with a not widely trusted cert?

[cigano]

Do you mean via a proxy with a not widely trusted cert?

@sscaling Yes, exactly.

[sscaling]

It sounds like the image would first need to fully support proxies (currently it does not). Then you could either build your own image based on this image as the base and just add the relevant certs to the CA root store. So until then, probably maintaining your own fork is probably the easiest.